|
| 1 | +# Release Notes |
| 2 | + |
| 3 | +## v2.3.0 — Frontend Security Auditing & Client-Side Secret Detection |
| 4 | + |
| 5 | +### Highlights |
| 6 | + |
| 7 | +Minor release adding frontend security auditing (CSP, CORS, cookies, SRI, XSS, open redirect, insecure forms, vulnerable CDN), client-side storage token detection, response header API key scanning, fingerprint state management library detection, and a comprehensive test suite for the scanner. All historical release notes have been rewritten in a user-friendly format. |
| 8 | + |
| 9 | +### What's New |
| 10 | + |
| 11 | +#### Secret Detection |
| 12 | + |
| 13 | +- **Client-side storage token detection** — Scans `localStorage`, `sessionStorage`, and `IndexedDB` references for stored tokens, secrets, and sensitive identifiers |
| 14 | +- **Fingerprint state management library detection** — Identifies state management libs (Redux, Zustand, Pinia, Vuex, etc.) used in client-side apps |
| 15 | +- **Response header API key scanning** — Scans response headers for exposed API keys and secrets |
| 16 | + |
| 17 | +#### Frontend Security Auditing |
| 18 | + |
| 19 | +- **CSP audit** — Evaluates Content-Security-Policy headers for weaknesses (missing directives, unsafe-inline, unsafe-eval, missing nonces) |
| 20 | +- **CORS audit** — Checks Cross-Origin Resource Sharing policies for overly permissive configurations |
| 21 | +- **Cookie security audit** — Inspects cookies for missing `HttpOnly`, `Secure`, and `SameSite` flags |
| 22 | +- **SRI verification** — Detects missing Subresource Integrity attributes on script and link tags |
| 23 | +- **XSS vulnerability scanning** — Probes endpoints for reflected XSS vulnerabilities |
| 24 | +- **Open redirect detection** — Identifies endpoints that allow unvalidated redirects |
| 25 | +- **Insecure form detection** — Flags forms submitted over HTTP instead of HTTPS |
| 26 | +- **Vulnerable CDN detection** — Identifies outdated or known-vulnerable CDN libraries |
| 27 | + |
| 28 | +#### Engine Improvements |
| 29 | + |
| 30 | +- **Comprehensive test suite** — Added thorough test coverage for scanner components, including secret detection, fingerprinting, and auditing modules |
| 31 | + |
| 32 | +### Documentation |
| 33 | + |
| 34 | +- Rewrote all historical release notes (v1.0.0 through v2.2.0-next) in a consistent, user-friendly format |
| 35 | +- Added missing release notes for v2.2.0-next, v2.2.0, v2.1.1, v2.1.0, v2.0.0, v1.1.6, v1.1.4, v1.1.1, v1.0.1, v1.0.0 |
| 36 | + |
| 37 | +### Maintenance |
| 38 | + |
| 39 | +- Added git-rndocs release notes generation config and template for consistent formatting |
| 40 | + |
| 41 | +### Contributors |
| 42 | + |
| 43 | +- Mark Wayne Buncaras Menorca (25 commits) |
| 44 | + |
| 45 | +### Full Changelog |
| 46 | + |
| 47 | +v2.2.0...v2.3.0 |
| 48 | + |
0 commit comments